14151 matches found
Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-7.0 / aspnetcore-targeting-pack-7.0 / etc Multiple Vulnerabilities (crlsa-2023_7256)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237256 advisory. dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand CVE-2023-36049 dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor...
AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787043977)
The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787043977 advisory. - When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause...
Rocky Linux 9 [CIQ] Security Update: squashfs-tools / squashfs-tools-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_2396)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242396 advisory. squashfs-tools: unvalidated filepaths allow writing outside of destination CVE-2021-40153 squashfs-tools: possible Directory Traversal via symbolic link...
Rocky Linux 9.6 [TuxCare] Security Update: tar (ALMALINUX9.6:CLSA-2026:1789131413)
The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789131413 advisory. - A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the...
Rocky Linux 10.1 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_5941)
The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20265941 advisory. cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url...
Rocky Linux 10.1 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2025_23667)
The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523667 advisory. git-lfs: Git LFS may write to arbitrary files via crafted symlinks CVE-2025-26625 Tenable has extracted the preceding description block directly from the CIQ...
Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / etc Multiple Vulnerabilities (crlsa-2023_7258)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237258 advisory. dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand CVE-2023-36049 dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor...
AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789462227)
The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789462227 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module...
AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1775040432)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1775040432 advisory. - Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content...
CVE-2026-94620: Improper Limitation of a Pathname to a Restricted Directory
Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...
CVE-2026-51883
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...
PT-2026-104033
Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description The Patcher Agent save code to project function contains a path traversal flaw. This issue allows attackers to write files outside the intended project workspace by manipulating file paths. Recommendations As a...
CVE-2026-51883
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...
CVE-2026-51883: Improper Limitation of a Pathname to a Restricted Directory
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...
CVE-2026-51882: Improper Limitation of a Pathname to a Restricted Directory
The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openaifiles directory by crafting malicious filenames...
PT-2026-104040
Name of the Vulnerable Software and Affected Versions Langchain-Chatchat version 0.3.0 Description The OpenAI-compatible file upload endpoint /v1/files is susceptible to path traversal, a condition where an attacker can access or write files outside the intended directory. By crafting malicious...
CVE-2026-51882
The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openaifiles directory by crafting malicious filenames...
PT-2026-105857
Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. Patches This issue is addressed in MPXJ version 16.5.0. Workarounds Do not read PRX or STX files from untrusted sources...
CVE-2026-51874
In Devika v1.0 , the Patcher Agent 's save_code_to_project function is susceptible to a path traversal vulnerability (CWE-22). This flaw allows an attacker to write files outside of the intended project workspace. The vulnerability has been observed in the wild, as evidenced by a sighting report....